2
$\begingroup$

The Wikipedia page on the subject and other descriptions that I can find of it are as clear as mud. $L$ and $R$ are combined to make a number that is then added to both. That seems like a loss of information to me.

$\endgroup$
2
$\begingroup$

One Lai-Massey round can be described as $$ \begin{align} L' &= \sigma(L \oplus F_k(L \oplus R)) \\ R' &= R \oplus F_k(L \oplus R)\,, \end{align} $$ where $F_k$ is some round function—not necessarily invertible—and $\sigma(\cdot)$ is an orthomorphism, an arbitrary function such that both $\sigma(x)$ and $\sigma'(x) = \sigma(x) \oplus x$ are invertible.

To invert this, $$ \begin{align} L &= \sigma^{-1}(L') \oplus F_k(\sigma^{-1}(L') \oplus R') \\ R &= R' \oplus F_k(\sigma^{-1}(L') \oplus R')\,. \end{align} $$ We can see this works because $$ \begin{align} \sigma^{-1}(L') &= L \oplus F_k(L \oplus R)\,, \end{align} $$ and $$ \begin{align} \sigma^{-1}(L') \oplus R' &= L \oplus F_k(L \oplus R) \oplus R \oplus F_k(L \oplus R) \\ &= L \oplus R\,. \end{align} $$

| improve this answer | |
$\endgroup$
  • $\begingroup$ Does $\sigma(\cdot)$ have to be applied to $L$? Can be applied to both $L$ and $R$? $\endgroup$ – Melab Oct 11 '17 at 0:49
  • $\begingroup$ Only applied to $L$. $\endgroup$ – Samuel Neves Oct 11 '17 at 4:41
  • $\begingroup$ But can it be applied to $R$, too? $\endgroup$ – Melab Oct 11 '17 at 11:19
  • $\begingroup$ Yes, but only one or the other, not both. $\endgroup$ – Samuel Neves Oct 11 '17 at 22:56
  • $\begingroup$ Why can't it be applied to both? $\endgroup$ – Melab Oct 12 '17 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.